Technical Details on the Recent Firefox Add-On Outage

Post by SECProto » Fri, May 10, 2019, 2:31 AM UTC

yellowapple wrote: post #167

SECProto wrote: post #129

Earlier quoted context omitted.

> I'd hardly call that a "barrier to entry" at all Would I have to sign in to sync again to access my bookmarks, logins, etc? Are there ever issues with syncing between phone and computer (nightly to stable) or would I have to change my desktop browser as well? Does anything ever break at all? Even if the answer to these questions is "no", the fact that I'm asking them is the barrier to entry. And if any of the answe…

> Even if the answer to these questions is "no", the fact that I'm asking them is the barrier to entry. Fair enough. The answers, for the record, are indeed "yes" (but that takes, what, 30 seconds?), "no", and (at least not severely) "no". But apparently even non-Nightly Firefox for Android supports xpinstall.signatures.required = false, which is even less of a barrier to entry, so that's good news, I guess. While I…

Post by brokenmachine » Fri, May 10, 2019, 2:35 AM UTC

sciurus wrote: post #171

brokenmachine wrote: post #160

Earlier quoted context omitted.

Well I've just been educated on a new mechanism by which things can be remotely broken.

Just to be clear: supported version or not, this sucks, and I hope we'll have a fix for you. I wanted to point out this wasn't remotely broken, however. Even if you had no internet connection, your addons would have stopped working when the certificate expired. (Disclosure: I work for Mozilla)

Post by [deleted] » Fri, May 10, 2019, 2:52 AM UTC

cortesoft wrote: post #149

StavrosK wrote: post #79

Earlier quoted context omitted.

Can you explain why you need the current time anywhere in this? Say I download a ten-year-old addon, it's signed by a valid signature from that root, with a valid signing date. What's the problem? Are we worried that someone will steal an old/expired cert and have control over a user's clock?

Imagine you have an old expired key... you take your new malicious extension, and sign it with the expired key and a time stamp that says it was signed at a time the key was still valid. Without some other verification mechanism, you can't tell the difference between this and an actual signature signed when the key WAS valid

Post by jldugger » Fri, May 10, 2019, 2:55 AM UTC

cortesoft wrote: post #149

StavrosK wrote: post #79

Earlier quoted context omitted.

Can you explain why you need the current time anywhere in this? Say I download a ten-year-old addon, it's signed by a valid signature from that root, with a valid signing date. What's the problem? Are we worried that someone will steal an old/expired cert and have control over a user's clock?

Imagine you have an old expired key... you take your new malicious extension, and sign it with the expired key and a time stamp that says it was signed at a time the key was still valid. Without some other verification mechanism, you can't tell the difference between this and an actual signature signed when the key WAS valid

Post by phist_mcgee » Fri, May 10, 2019, 3:17 AM UTC

brokenmachine wrote: post #160

y-satellite wrote: post #154

Earlier quoted context omitted.

In this day and age you're living on borrowed time using an old version of a web browser. This state of affairs has its good and bad, but your modern-day browser vendors don't typically maintain branches of old versions to make security and bug fixes (especially when they change things for security reasons, as with this case of old-style addons being removed). If you're going to insist on using an old unsupported ver…

Well I've just been educated on a new mechanism by which things can be remotely broken.